3 ms·

Or (to present an alternative explanation for why one might try to see what ports are open and whether some rudimentary attacks can succeed) maybe he was trying

by yebyen 12y ago

Or (to present an alternative explanation for why one might try to see what ports are open and whether some rudimentary attacks can succeed) maybe he was trying to evaluate a potential vendor and decide whether or not to put his secure personal or company information into the system. You know, rudimentary attacks that should not succeed on any type of vendor system that has been through the most basic security audit or pen testing? I guess we should either trust the vendor or don't. No real reason why would anyone want to see if other hackers with basic knowledge can get access to a system? I'm sure there are plenty vendors with transparent public records of the authorized penetration tests that they have ordered which have been done, you can trust!

Consultant32452 12y ago
There are a number of passive things you can do to gain some trust in an online vendor. You can, for example, look for certifications from a service like SiteLock. To maintain the brick and mortar analogy, you wouldn't try to pick the locks of a storefront after hours just to determine whether or not you should do business with them. And if you get caught doing that, I dare say you deserve to be charged with a crime.
- yebyen 12y ago
  Sending packets with strings which are commonly known to cause serious problems if systems are vulnerable to well-known exploits should not be a crime. If your system solicits users to input their private data and is vulnerable to easy attack vectors or common exploits like basic SQL injection, you are the one who should be charged. So, the only problem left is how to establish your standing to sue the lazy vendor. It is a problem since you can't actually bring them up on negligence charges if you were not actually damaged. Well, if picking the lock is thus illegal per your analogy, then the only way to have standing would be to first submit yourself to potential unknown harm and wait for the day when a bad hacker comes! I think your analogy falls down too, because a brick-and-mortar storefront holds its own assets and is liable (or insured) for their own losses in the event of theft. You rarely store your own private things inside a brick and mortar storefront. If you did and they are stolen, the store would normally be liable and reimburse you. People store their private data "in the cloud" all the time, but because of arcana in law which does not correctly distinguish between pulling on the handle and picking the lock, they are not allowed to check and see if the cloud-monger actually locks the door when he goes home at night?
  - Consultant32452 12y ago
    There are ways to determine if a site is secure without attempting to gain unauthorized entry. You can look for third party certifications, a valid SSL certificate, etc. This is similar to the analogy of looking around at your bank to see they have a security person, locks, cameras, etc. protecting your safe deposit box. You don't go try to break into the bank to determine if it's reasonable to put your assets in the box there.
    - msandford 12y ago
      No, not really. It's the wild west. SSL certs don't do anything to prevent SQL injection. That's done at the application layer, not the transport layer. You seem to be out of your depth. This is equivalent to "checking to see if the door is unlocked when it should be locked" not "trying to pick the lock after hours"
      - Consultant32452 12y ago
        I'm not out of my depth, this is what I do for a living. Verifying that a site is using valid SSL is one of the myriad of tools at your disposal to make sure a site is taking reasonable safety precautions with your data. That, accompanied by a third party trusted certification that indicates some basic penetration testing has been performed is reasonable protection for almost any data you'd be putting on the internet.
        emn13 12y ago
        If you think that verifying that a site is using valid SSL is a tool to make sure that a site is taking reasonable safety precautions with your data, you most definitely are entirely out of your depth. As to trusted certification - please elaborate; because many of these "certifications" are entirely worthless (some indeed indicate that a site is less likely to be safe).
        msandford 12y ago

by yebyen 12y ago

Consultant32452 12y ago

There are a number of passive things you can do to gain some trust in an online vendor. You can, for example, look for certifications from a service like SiteLock. To maintain the brick and mortar analogy, you wouldn't try to pick the locks of a storefront after hours just to determine whether or not you should do business with them. And if you get caught doing that, I dare say you deserve to be charged with a crime.

yebyen 12y ago
Sending packets with strings which are commonly known to cause serious problems if systems are vulnerable to well-known exploits should not be a crime. If your system solicits users to input their private data and is vulnerable to easy attack vectors or common exploits like basic SQL injection, you are the one who should be charged. So, the only problem left is how to establish your standing to sue the lazy vendor. It is a problem since you can't actually bring them up on negligence charges if you were not actually damaged. Well, if picking the lock is thus illegal per your analogy, then the only way to have standing would be to first submit yourself to potential unknown harm and wait for the day when a bad hacker comes! I think your analogy falls down too, because a brick-and-mortar storefront holds its own assets and is liable (or insured) for their own losses in the event of theft. You rarely store your own private things inside a brick and mortar storefront. If you did and they are stolen, the store would normally be liable and reimburse you. People store their private data "in the cloud" all the time, but because of arcana in law which does not correctly distinguish between pulling on the handle and picking the lock, they are not allowed to check and see if the cloud-monger actually locks the door when he goes home at night?
- Consultant32452 12y ago
  There are ways to determine if a site is secure without attempting to gain unauthorized entry. You can look for third party certifications, a valid SSL certificate, etc. This is similar to the analogy of looking around at your bank to see they have a security person, locks, cameras, etc. protecting your safe deposit box. You don't go try to break into the bank to determine if it's reasonable to put your assets in the box there.
  - msandford 12y ago
    No, not really. It's the wild west. SSL certs don't do anything to prevent SQL injection. That's done at the application layer, not the transport layer. You seem to be out of your depth. This is equivalent to "checking to see if the door is unlocked when it should be locked" not "trying to pick the lock after hours"
    - Consultant32452 12y ago
      I'm not out of my depth, this is what I do for a living. Verifying that a site is using valid SSL is one of the myriad of tools at your disposal to make sure a site is taking reasonable safety precautions with your data. That, accompanied by a third party trusted certification that indicates some basic penetration testing has been performed is reasonable protection for almost any data you'd be putting on the internet.
      - emn13 12y ago
        If you think that verifying that a site is using valid SSL is a tool to make sure that a site is taking reasonable safety precautions with your data, you most definitely are entirely out of your depth. As to trusted certification - please elaborate; because many of these "certifications" are entirely worthless (some indeed indicate that a site is less likely to be safe).
        msandford 12y ago